wanjie-openclaw-video

高性能 Veo 视频生成技能，支持自然语言一键生成及后台自动依赖修复、超时自愈与任务监控。

Key points to consider before installing: - This skill will read your OpenClaw API key from ~/.openclaw/openclaw.json. If you are not comfortable granting a skill access to that file, do not install it. The manifest does not declare this requirement explicitly. - At runtime it may pip-install the requests package into your Python environment; run it inside a virtualenv or isolated environment if you want to avoid changing system packages. - The skill launches detached background Python processes and writes veo_log.txt, veo.lock, and veo_result.txt into its scripts folder. These processes persist outside the chat session; verify and monitor them if you install the skill. - The worker will automatically open any URL returned by the remote API in your default browser. A malicious or compromised backend could return an unsafe URL — only use if you trust the remote service (maas-openapi.wanjiedata.com). - The SKILL.md mentions additional monitoring/scheduling behavior (Windows task), but the code does not implement automatic task registration; behavior described in docs and actual code differ. Recommendations: 1) Inspect the included Python files (veo_worker.py, video_interface.py) yourself (they are present) and run them in a controlled environment first. 2) Use a throwaway/limited OpenClaw API key or run on a machine without sensitive credentials if you want to test. 3) If you decide to install, run the skill inside a Python virtualenv and monitor processes/files it creates. If you need the skill but want stricter behavior, ask the author to declare the config requirement in the manifest and to make URL-opening and auto pip-installation opt-in.

Type: OpenClaw Skill Name: wanjie-openclaw-video-v2-0-1 Version: 2.0.0 The skill exhibits high-risk behavior by programmatically extracting the first available API key from the user's global OpenClaw configuration (~/.openclaw/openclaw.json) and transmitting it to an external endpoint (maas-openapi.wanjiedata.com) in veo_worker.py, which could lead to the leakage of unrelated service credentials (e.g., OpenAI/Anthropic keys). Furthermore, SKILL.md and README.md claim the plugin installs a Windows Task Scheduler task ('OpenClaw_Veo_Monitor') for persistence and 'automated monitoring,' although the code to implement this is missing from the bundle. The skill also performs background process spawning and automatically opens URLs returned by the remote API using platform-specific commands like os.startfile and xdg-open.